Splunk Search

Use subsearch results as data in outer search

nicolasperrenou
Engager

Hi

I have a subsearch which searches for certain events (suspicious requests that sometimes happen after a user has logged into my system) inside an apache access log. The fields I need are the IP and the timestamp. The IP is used as a search query in the outer search, which is a query to an authentication log. In the final results, I need all the data of the outer search (the auth log), the IP (which is part of both logs) and the timestamp that comes from the access log (which is not part of the search condition).

How can I achieve this results set the most performant way? The set and join commands are too slow as the auth log is very large. What I'm currently doing is (in pseudo code)

search_auth_log [ search_access_log | fields +ip ] OR search_access_log | transaction ip 

It works, but the drawback is that I have to do the subsearch query two times. Is there a better solution?

Thanks and best regards

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

The best approach is probably to combine the searches into a disjunction and not use join at all.

(<search 1>)  OR (<search 2>) 

and then pipe that to something like

| stats dc(user) by IP

Can you give more details of the exact searches?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...